Test the integration between the Entrust nShield HSM and Idira ISP

This test consists of rotating the Vault Server keys.

  1. Stop the Vault Server.

  2. Back up the original HSM key blob files from C:\ProgramData\nCipher\Key Management Data\local and the Vault Server key files from C:\keys\.

  3. Open a command prompt with administrator privileges and navigate to the following directory:

    cd "C:\Program Files (x86)\PrivateArk\Server"

  4. Generate a new Vault Server key on the HSM key following the instructions in Generate a new Vault Server key on the HSM.
    If the existing key is HSM#1, the new key will be HSM#2.

    For example:

    C:\Program Files (x86)\PrivateArk\Server>.\CAVaultManager GenerateKeyonHSM /ServerKey
ITADB518W MaxConcurrentUsersByClientID activated in dbparm.ini.
ITADB399I Using encryption algorithms: Advanced Encryption Standard (AES), 256 bit, RSA (2048 bit), SHA2-512 (Protocol Integrity), SHA2-512 (Files Integrity).
ITAFW052I Firewall is open for non standard address.
ITAFW052I Firewall is open for non standard address.
...
ITAFW052I Firewall is open for non standard address.
ITAFW052I Firewall is open for non standard address.
ITADM114I Successfully connected to Database, Database id 0.
CAVLT187I Server Key was successfully generated on HSM device (KeyID=HSM#2).

  5. Verify that the following key blob files correspond to the existing and newly generated key.

    C:\Program Files (x86)\PrivateArk\Server>dir "C:\ProgramData\nCipher\Key Management Data\local" | findstr key_pkcs11
09/16/2026  05:19 PM             7,248 key_pkcs11_ucedb3d45a28e5a6b22b033684ce589d9e198272c2-92c66522d74cce447056ca72f3a048927e31c778
09/18/2026  09:09 AM             7,448 key_pkcs11_ucedb3d45a28e5a6b22b033684ce589d9e198272c2-d4884f839e3754cc11c8ce34bb27a1355182a408

  6. Wrap the Vault Server keys with the new HSM key following the instructions in Wrap the Vault Server keys with the HSM key.

    For example

    C:\Program Files (x86)\PrivateArk\Server>.\ChangeServerKeys C:\keys C:\keys\VaultEmergency.pass HSM#2
18/09/2026 09:22:34 CHSRVK041I ChangeServerKeys process started.
ITADB518W MaxConcurrentUsersByClientID activated in dbparm.ini.
ITADB399I Using encryption algorithms: Advanced Encryption Standard (AES), 256 bit, RSA (2048 bit), SHA2-512 (Protocol Integrity), SHA2-512 (Files Integrity).
ITAFW051W Error open firewall for non standard address. Code: 4, -1.
ITADM114I Successfully connected to Database, Database id 0.
ITAQS031I Object cache is loaded.
HSM generation 2 was chosen, are you sure you want to change server keys to HSM (y/n)?
y
Verify that the current master key is at C:\keys\recprv.key, and press any key.
Verify new server's master key is at C:\keys, and press any key.

18/09/2026 09:22:56 CHSRVK043I Signing entropy file C:\PrivateArk\Safes\entropy.rnd with new keys.
18/09/2026 09:22:56 CHSRVK034I Encrypting server private key.
...
18/09/2026 09:22:59 CHSRVK020I Keys of Safe AccountsFeedDiscoveryLogs changed successfully.
18/09/2026 09:22:59 CHSRVK054I ChangeServerKeys process was successful. DBParm.ini must be updated to point to new keys for Vault to start.

Do you want to update DBParm.ini with the new  keys location? Enter "NO" to quit or "YES" for update:
YES
18/09/2026 09:23:09 CHSRVK087I DBParm.ini file was successfully updated.
18/09/2026 09:23:09 CHSRVK042I ChangeServerKeys process ended.

  7. Update C:\Program Files (x86)\PrivateArk\Server\Conf\dbparm.ini to reference the new HSM#2 key following the instructions in Update dbparm.ini to use the new HSM key.

    ServerKey=HSM#2

  8. IMPORTANT: Verify that a backup of the original HSM key blob files and the Vault Server key files exists before proceeding.

  9. Remove the original HSM key blob file from C:\ProgramData\nCipher\Key Management Data\local so only the new key blob file remains.

    C:\Program Files (x86)\PrivateArk\Server>dir "C:\ProgramData\nCipher\Key Management Data\local" | findstr key_pkcs11
09/18/2026  09:09 AM             7,448 key_pkcs11_ucedb3d45a28e5a6b22b033684ce589d9e198272c2-d4884f839e3754cc11c8ce34bb27a1355182a408

  10. Start the Vault Server as described in Start the Vault Server.